Terms of Service
Last updated: July 2026
1. Operator and Contact
PackStorm ("PackStorm", the "Service") is operated by Hariton Stuckert, an individual sole trader established in Germany (the "Operator", "we", "us"). The Operator's postal address and further identification details are set out in the Impressum, available at any time in the app. For any matter relating to these Terms, your account, billing, or legal notices, contact us at support@packstorm.net. We communicate with users primarily by email.
2. Scope and Acceptance
These Terms of Service ("Terms") govern your access to and use of PackStorm and form a binding agreement between you ("you", "User") and the Operator. By creating an account or otherwise using the Service, you confirm that you have read and agree to these Terms. If you do not agree, do not use the Service.
3. The Service
PackStorm lets you photograph trading cards and receive automated identification, descriptive information, a rarity assessment, and an estimated market value generated by third-party artificial-intelligence systems, together with personal collection management, scan history, and a browsable database of cards. All identifications, descriptions, and prices are automated estimates and may be incomplete, outdated, or incorrect.
4. Eligibility
You must be at least 16 years old and able to enter into a binding contract to use the Service. The Service is not directed at children under 16. If you are between 16 and 18, you confirm that your parent or legal guardian consents to your use of the Service and to any purchases you make.
5. Account Registration and Security
To use most features you must create an account with a valid email address and a password. You agree to provide accurate information, keep your credentials confidential, and not share, sell, or transfer your account. You are responsible for all activity under your account and must notify us promptly at the contact address above of any unauthorized use. We may suspend or terminate accounts that breach these Terms or that threaten the security or integrity of the Service.
6. Subscriptions and Billing
Certain features require a paid subscription, offered in monthly tiers ("Basic", "Plus", "Premium") at the prices shown in the app at the time of purchase. Payments in the web/PWA version are processed by our payment provider Stripe (Stripe Payments Europe, Limited); by subscribing you also accept Stripe's terms and authorize the recurring charge to your chosen payment method on each billing date. Subscriptions renew automatically at the then-current price until you cancel. You may cancel at any time in the app; cancellation takes effect at the end of the current paid period, and you keep access until then.
Where you purchase or subscribe through a third-party app marketplace (for example Google Play or the Apple App Store), that purchase is billed and managed by the marketplace under its own payment terms, and any cancellation or refund for it is handled through that marketplace rather than by us.
7. Extra Balance Top-Ups
When your subscription's monthly allowance is used up, you may buy additional usable balance ("Extra Balance") as a one-time top-up. A defined portion of the amount you pay (shown at purchase) is credited as Extra Balance and consumed at the actual processing cost of each further scan. Extra Balance is non-refundable once credited, is not transferable, has no cash value, and can only be consumed while a subscription is active; if your subscription ends it remains on the account but is unusable until a subscription is active again.
8. Redemption Codes
We may distribute redemption codes granting a limited, time-bound benefit. Each code is single-use, non-transferable, has no cash value, and may not be resold or exchanged. A subscription granted by a code cannot be cancelled and ends automatically when its duration expires. Codes obtained through fraud or abuse may be invalidated at any time without notice or compensation.
9. Right of Withdrawal, Immediate Performance, and Refunds
If you are a consumer in the EU/EEA (or another jurisdiction granting a statutory right of withdrawal), you generally have 14 days to withdraw from a distance contract for a paid digital service or digital content. Because the Service is delivered immediately, we ask for your express consent to begin at once.
By purchasing and starting to use a subscription, a coded benefit, or an Extra Balance top-up, you (a) expressly request that we begin performance before the 14-day withdrawal period ends, and (b) acknowledge that you thereby lose your right of withdrawal: for a paid service once it has been fully performed (§ 356 Abs. 4 BGB), and for digital content supplied outside a physical medium as soon as performance begins with your prior express consent (§ 356 Abs. 6 BGB), implementing Directive 2011/83/EU. We provide confirmation of this consent on a durable medium (§ 312f BGB).
Except where a statutory withdrawal right applies and has not lapsed, all payments, subscriptions, renewals, and top-ups, are final and non-refundable to the maximum extent permitted by law, including unused allowances. Mandatory statutory rights that cannot be waived under the law of your country of residence remain unaffected.
10. Price and Plan Changes
We may change subscription prices, tier features, billing intervals, or allowances. Material changes affecting an existing subscription will be sent to your account email at least thirty (30) days before they take effect. If you do not agree, your only remedy is to cancel before the change takes effect; continued use after that date constitutes acceptance.
11. Acceptable Use
You agree not to: (a) use the Service in violation of any law; (b) upload content that is illegal, infringing, defamatory, sexually explicit, or otherwise objectionable; (c) submit images you have no right to upload; (d) submit any image depicting the face of a person other than yourself outside the boundaries of a trading card; (e) attempt to gain unauthorized access to the Service or other users' accounts or infrastructure; (f) reverse-engineer, decompile, scrape, mirror, or extract source code, data, or APIs from the Service; (g) interfere with, overload, or disrupt the Service or its servers; (h) use the Service to develop a competing product; or (i) circumvent or abuse usage limits, payments, redemption codes, or any access control. We may immediately suspend or terminate an account for any breach of this section.
12. Your Content; Licence; Public Sharing
You retain all rights you may hold in the images and content you submit ("User Content"). To operate the Service, you grant us a worldwide, non-exclusive, royalty-free, sublicensable licence to host, store, copy, process, transmit, display, and modify (e.g., resize, compress, rotate) your User Content solely to (i) provide and operate the Service, (ii) generate identification and pricing estimates through third-party AI systems, (iii) maintain your collection and history, and (iv) maintain and improve the Service.
Public sharing of your card images to other users is off by default: images are published only where you actively choose to publish them, per card or through your publishing setting. If you publish an image, you additionally grant us a worldwide, non-exclusive, royalty-free right to display it publicly to other users alongside the corresponding card record for as long as it remains published. You can stop publishing at any time: your publishing setting stops future publishing, and any published image can be set back to private in the app, after which it is removed from public display and is again visible only to your account (copies already delivered to other users' devices may persist briefly in their local caches). If you delete your account while images are still published, the link between those images and your account is removed and they remain part of the Service's card database. Deleting your account removes all remaining data still linkable to you.
You represent and warrant that you own all rights in your User Content or have all necessary permissions to grant the licence above, and that your User Content does not infringe any third party's rights.
13. AI-Generated Information; No Financial Advice
All identifications, descriptions, rarity scores, and price estimates are produced by automated artificial-intelligence systems from the images you submit and publicly available data, and are provided for general information only. They may be incomplete, outdated, or incorrect. The Service is not, and does not provide, financial, investment, appraisal, grading, or legal advice. You must not rely on it for buying, selling, trading, insurance, taxation, or any other decision, and you accept full responsibility for any decision you make based on its output.
14. Third-Party Trademarks and Card IP
Card names, artwork, set names, logos, character likenesses, and other trademarks shown by the Service belong to their respective rights holders. Their appearance is descriptive and nominative only and implies no endorsement, affiliation, sponsorship, or licence between those rights holders and the Operator. If you are a rights holder and believe content displayed by the Service infringes your rights, contact us at the address above and we will address it within a reasonable time.
15. Availability
The Service is provided on an "as is" and "as available" basis. We do not guarantee that it will be uninterrupted, error-free, secure, or available at any particular time or place. Maintenance, updates, third-party outages (including OpenAI, Stripe, and hosting providers), force-majeure events, and other circumstances may cause downtime or feature degradation. We reserve the right to modify, suspend, or discontinue the Service or any part of it at any time, with or without notice.
16. Limitation of Liability
We are liable without limitation for damage caused by intent or gross negligence, for injury to life, body, or health, for liability under the German Product Liability Act (Produkthaftungsgesetz), and for any other liability that cannot be limited or excluded under mandatory law.
For slight negligence, we are liable only where an essential contractual obligation ("Kardinalpflicht"), an obligation whose fulfilment makes proper performance of the contract possible at all and on whose fulfilment you may regularly rely, has been breached, and only up to the foreseeable damage typical for this type of contract.
All other liability, including for indirect or consequential damage, lost profits, lost or corrupted data, third-party claims, and inaccurate AI-generated information, is excluded to the maximum extent permitted by law. You are responsible for keeping your own backups of any data important to you.
17. Indemnification
To the extent permitted by law, you agree to hold the Operator harmless from any third-party claim, demand, loss, or liability (including reasonable legal fees) arising out of (a) your breach of these Terms, (b) your violation of applicable law, (c) your infringement of any third party's rights, or (d) the content you submit to the Service. This clause does not apply where mandatory law allocates liability differently.
18. Term and Termination
You may terminate your account at any time using the "Delete Account" function in settings. Termination is immediate and irreversible. Active subscriptions are cancelled and no refund is issued for the remainder of any paid period or for any unused Extra Balance. We may suspend or terminate your account for breach of these Terms, suspected fraud or abuse, or as otherwise permitted by law, with or without prior notice.
19. Changes to These Terms
We may amend these Terms at any time. The current version is always shown in the app. Where changes are material, we will notify you in advance by email at the address linked to your account. Continued use of the Service after the changes take effect constitutes acceptance; otherwise you must stop using the Service and may delete your account.
20. Governing Law and Jurisdiction
These Terms and any non-contractual obligations arising out of or in connection with them are governed by the substantive law of the Federal Republic of Germany, excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG) and conflict-of-laws rules.
If you are a consumer, this choice of law does not deprive you of the protection of the mandatory provisions of the law of your country of residence. Where legally permissible, the courts at the Operator's place of business have jurisdiction; consumers may also sue and be sued at their place of residence under mandatory consumer-protection rules.
21. Consumer Dispute Resolution
The European Commission's Online Dispute Resolution (ODR) platform was discontinued on 20 July 2025 and is no longer available. We are neither obliged nor willing to participate in dispute-resolution proceedings before a consumer arbitration board (§ 36 VSBG).
22. Severability
If any provision of these Terms is held invalid, unenforceable, or void, the remaining provisions remain in full force. The invalid or unenforceable provision shall be replaced by a valid one whose economic effect comes as close as legally permitted to the intended effect of the original.
23. Contact
All notices, questions, complaints, or legal requests relating to these Terms must be sent to support@packstorm.net. The Operator's postal address and identification details are provided in the Impressum.
Privacy Policy
Last updated: July 2026
1. Controller
The controller responsible for the processing of personal data within the meaning of Art. 4(7) GDPR is:
Hariton Stuckert
Hans-Kopp-Straße 11
67227 Frankenthal
Germany
Email: support@packstorm.net
No data protection officer is required or appointed, as PackStorm does not meet the thresholds for mandatory designation under Art. 37 GDPR.
2. Categories of Personal Data We Process
(a) Account data: your email address and a cryptographically hashed password (Argon2). If you change your email, we keep the previous address solely so that delayed payment webhooks can still be matched to your account.
(b) Authentication data: a session token stored as an HTTP-only cookie ("token") on your device and a matching record in our database for the duration of the session (up to 30 days of inactivity).
(c) Content and usage data: the card images you submit, the resulting metadata (card name, manufacturer, set, rarity, price estimate, etc.), per-scan usage, your scan history, and the cards in your collection.
(d) Payment data: subscription tier, subscription start/end timestamps, your Stripe customer and subscription identifiers, and one-time top-up records. Your actual payment instrument details (card numbers, bank details) are processed exclusively by Stripe and never reach us.
(e) Preferences: your image-publishing setting (stored server-side); your language and usage-view settings (stored only in your browser).
(f) Technical data: your IP address, browser user agent, and request timestamps are handled at the network level by our hosting provider for rate-limiting and access logging. We do not store these in our own database.
3. Purposes and Legal Bases (Art. 6 GDPR)
• Account creation, scanning, and collection/history management, Art. 6(1)(b), performance of contract.
• Processing card images via AI to identify cards and produce price estimates, Art. 6(1)(b).
• Billing via Stripe and retaining payment and invoice records, Art. 6(1)(b) and Art. 6(1)(c), legal obligation (§ 147 AO requires retention of payment records).
• Rate-limiting, abuse prevention, and service security, Art. 6(1)(f), legitimate interest in the integrity of the Service.
• Sending verification and account emails, Art. 6(1)(b).
• Publicly displaying your card images to other users, only where you actively choose to publish them; publishing is off by default, Art. 6(1)(a), consent, revocable at any time, per image by setting it back to private in the app and for future scans via the publishing setting.
• Translating AI-generated card text into your selected language, Art. 6(1)(b).
4. Recipients and Processors
We share data only with the providers below, strictly as needed to operate the Service. None of them use your data for advertising or sell it.
OpenAI, L.L.C. (United States), receives card images and prompts to generate identification and pricing data. Under OpenAI's API terms, this data is not used to train OpenAI's models. Transfer safeguarded by the EU Standard Contractual Clauses (Art. 46 GDPR). OpenAI Privacy Policy.
Stripe Payments Europe, Limited (Ireland), payment processing; acts as our processor and, for fraud prevention and legal-compliance purposes, as an independent controller. Stripe Privacy Policy.
Sender.net (Lithuania), transactional email delivery (verification codes and account emails). EU-based processor.
Google LLC (United States), the public translation endpoint translate.googleapis.com, called from your browser to translate AI-generated card text into your selected language. Only that card text and your device's IP address are transmitted; no account identifiers, email, or images are sent. Transfer safeguarded by Standard Contractual Clauses.
Render Services, Inc. (United States; application hosted in its Frankfurt, Germany data center), hosting provider. Application data is stored on EU servers; the operating company is U.S.-based and acts as a sub-processor under Standard Contractual Clauses.
5. International Data Transfers
Some processors above are based in the United States. Transfers of personal data to the United States rely on the EU Standard Contractual Clauses (Art. 46 GDPR) concluded with the respective processor. Where a processor is U.S.-based but the data is physically stored in the EU (Render Frankfurt), the data does not leave the EU in storage. A copy of the applicable clauses is available on request.
6. Retention
Account data and content (email, password hash, card scans, collection, scan history, session tokens, email-change history, redemption-code links), kept for as long as your account is active, and deleted when you use the in-app "Delete Account" function.
Published card images, publicly visible while published and linked to your account so you can set them back to private at any time. If you delete your account while images are still published, the link is deleted and the images remain part of the public card database, no longer traceable to you.
Payment records (subscription and top-up records), retained for 10 years as required by § 147 AO (tax law) and § 257 HGB (commercial law). When you delete your account, these records are anonymized: the link to your account is removed, but the transaction date, amount, and Stripe transaction identifiers are retained for tax-audit purposes and can no longer be traced back to you.
Verification codes: deleted automatically 5 minutes after generation, or earlier on successful use.
Session tokens: deleted after 30 days of inactivity, on logout, or on subscription tier-down.
Network and rate-limit logs: handled at the infrastructure level by our hosting provider according to its own retention (typically short-term).
7. Your Rights
Under the GDPR you have the rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17, subject to the tax-retention obligation in section 6), restriction of processing (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21), and withdrawal of consent (Art. 7(3)) at any time without affecting the lawfulness of prior processing. You can download a full copy of your data yourself at any time using the "Export my data" function in settings (Art. 15/20), delete your account with the "Delete Account" function (Art. 17), and change your publishing consent at any time with the publishing setting or by setting a published image back to private (Art. 7(3)). For any other request, contact support@packstorm.net; we will respond within one month (Art. 12(3)).
8. Right to Lodge a Complaint
You have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR). The authority competent for the controller is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34
55116 Mainz
Germany
https://www.datenschutz.rlp.de
9. Minimum Age
PackStorm is intended for users aged 16 and over and is not directed at children under 16. We do not knowingly process personal data of persons under 16. If you believe a younger child has registered, please contact us and we will delete the account.
10. Cookies and Local Storage
PackStorm uses one strictly necessary cookie, the HTTP-only session token, and browser localStorage to remember your login, preferences, and cached content. We use no tracking, analytics, or third-party advertising cookies, so no cookie-consent banner is shown.
11. Automated Decision-Making
Card identification, rarity scoring, and price estimates are produced by automated AI systems, but they have no legal or similarly significant effect on you within the meaning of Art. 22 GDPR. They are informational estimates only and do not constitute financial, appraisal, or investment advice.
12. Data Security
We implement technical and organisational measures appropriate to the risk under Art. 32 GDPR, including TLS encryption for all client/server traffic, Argon2 password hashing, signed Stripe webhook verification, restricted server access, and short-lived session tokens.
13. Changes to This Policy
We may update this Privacy Policy as the Service evolves. The date at the top reflects the most recent change. We will notify you by email to the address linked to your account before material changes take effect.
14. Contact
For any privacy-related request or question:
Hariton Stuckert
Hans-Kopp-Straße 11
67227 Frankenthal
Germany
Email: support@packstorm.net
Impressum
Last updated: July 2026
Information pursuant to § 5 DDG (Digitale-Dienste-Gesetz)
Hariton Stuckert
Hans-Kopp-Straße 11
67227 Frankenthal
Germany
Contact
Email: support@packstorm.net
Value-Added Tax
As a small business within the meaning of § 19 UStG, we do not show or charge value-added tax, and no VAT identification number is issued.
Responsible for content pursuant to § 18 Abs. 2 MStV
Hariton Stuckert (address as above)
Consumer Dispute Resolution
The European Commission's Online Dispute Resolution (ODR) platform was discontinued on 20 July 2025 and is no longer available. We are neither obliged nor willing to participate in dispute-resolution proceedings before a consumer arbitration board (§ 36 VSBG).
Liability for Content
As a service provider we are responsible for our own content on these pages under § 7(1) DDG. Under §§ 8 to 10 DDG, however, we are not obliged to monitor transmitted or stored third-party information or to investigate circumstances that indicate illegal activity. Obligations to remove or block the use of information under general law remain unaffected; liability in this regard arises only from the point at which a concrete infringement becomes known. Upon becoming aware of such infringements, we will remove the content concerned promptly.
Liability for Links
Our offer may contain links to external third-party websites over whose content we have no influence. We therefore accept no liability for these external contents. The respective provider or operator of the linked pages is always responsible for their content. The linked pages were checked for possible legal violations at the time of linking, and no illegal content was recognizable at that time. Permanent monitoring of the content of linked pages is not reasonable without concrete indications of an infringement. Upon becoming aware of legal violations, we will remove such links promptly.
Copyright
The content and works on these pages created by the operator are subject to German copyright law. Reproduction, editing, distribution, and any form of exploitation beyond the limits of copyright require the prior written consent of the respective author or creator. Downloads and copies of these pages are permitted for private, non-commercial use only. Where the content on this site was not created by the operator, the copyrights of third parties are respected and such content is marked as third-party. Should you nevertheless become aware of a copyright infringement, please inform us and we will remove such content promptly.
